{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.062367696,
        "rte": "az",
        "prob": 0.062367696
      },
      {
        "cls": 0,
        "raw": 0.08170602,
        "rte": "az/native",
        "prob": 0.08170602
      },
      {
        "cls": 0,
        "raw": 0.5244907,
        "rte": "az/pe",
        "prob": 0.5244907
      }
    ],
    "prob": 0.062367696,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.062367696315050125,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T10:06:41Z"
  },
  "path": "22894",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "PE binary has trailing overlay data",
                "i": "metadata/binary/layout::has-overlay",
                "o": 0,
                "z": 25
              }
            ],
            "x": true
          },
          {
            "b": "H5.i!z#Y(Z0a#py0cwh[0a=dP0a=cM0bhBA0c!G.0bITN0ce6J04[m.0c!GP03znN0bhBN0a=dx0b?\u003cZ04[m.0c!GP03znK0b8vM0b?\u003cO0a=c.0a=dP00",
            "l": 27425,
            "n": [
              {
                "c": 3,
                "d": "Browser application name markers",
                "i": "micro-behaviors/process/enumerate/apps::browser-apps",
                "o": 27466,
                "z": 10
              },
              {
                "c": 3,
                "d": "Browser app iexplore",
                "i": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore",
                "o": 27441,
                "z": 8
              },
              {
                "c": 2,
                "d": "Firefox Windows executable",
                "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox-exe",
                "o": 27454,
                "z": 11
              },
              {
                "c": 2,
                "d": "Browser app opera",
                "i": "micro-behaviors/process/enumerate/apps::browser-apps-opera-brave",
                "o": 27477,
                "z": 9
              }
            ],
            "x": true
          },
          {
            "b": "Z.)2sQp(ygh^pp60rr91lPOEsB.LV5B6I4Ox(4r!q!Q8*AaK5^A=jV{y\u0026\u003cw@n(Fb#x)a6dtRN\u0026/ga\u003emkfKdTAuO=4AtTAdxtVbcHwNPT\u003etXXs\u003cA=%6OwmtJs4GDFe0@@r30@@r3000000000000000PL%(hrcn",
            "l": 28680,
            "n": [
              {
                "c": 3,
                "d": "Embedded absolute PDB path",
                "i": "metadata/binary/debug::pdb-absolute-path",
                "o": 28696,
                "z": 78
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000000000004@SrG3ivqc3:O{eUi{r{hP{%nO=jKu-/XpuB*NG$}^kji8E}\u003eS5Ry0eedf2m\u0026LCrS8d\u0026P-",
            "l": 29680,
            "n": [
              {
                "c": 2,
                "d": "Writable and executable section (W^X violation)",
                "i": "metadata/hardening/memory::wx-section",
                "o": 29696,
                "z": 29
              }
            ],
            "x": true
          },
          {
            "b": "wO1XRz!@G?BzaSZx8{A-o(ijtx(4rOwnB.NA.ZK\u003cp*[0FwkEh.yYIGRnPc[hy\u0026r/(By!fSyYC4GnPd7swO1ODyYJk\u003cmf",
            "l": 30442,
            "n": [
              {
                "c": 3,
                "d": "NonPagedPool kernel memory flag",
                "i": "micro-behaviors/mem/alloc/executable::nonpaged-pool",
                "o": 30458,
                "z": 25
              }
            ],
            "x": true
          },
          {
            "b": "zdvKg002!2zdNN9wPN[LzGG/ryJsree[Gos0058+qGM.PzG//jwb)hwpgO6Wl2pvQv{%E\u003cm}DNH",
            "l": 30552,
            "n": [
              {
                "c": 2,
                "d": "Kernel driver ntoskrnl in INIT",
                "i": "metadata/binary/resource::kernel-driver-init",
                "o": 30568,
                "z": 12
              }
            ],
            "x": true
          },
          {
            "b": "B.b8ZAa%h-z!0L.07YyHe[w^m0gTc:wMiwNyEr2.zGC)m0.W8\u003eB.s6PwN/HACMm.(",
            "l": 31345,
            "n": [
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 31361,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "00000000000049xgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rsOH0rw.",
            "l": 31830,
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 31846,
                "z": 15
              }
            ],
            "x": true
          },
          {
            "b": "fAr{fvGn7Z001?Q1][V7mGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003:lA@Y.JASym.001$U3\u0026*qdmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nec4Hbg5@\u003c9f-S:8g5%chhukJk001?Q3ig8bnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003:lA@Y.JASym.e=Y})C(R)=",
            "l": 31982,
            "n": [
              {
                "c": 2,
                "d": "PE with version resource and broad imports",
                "i": "metadata/binary/layout::import-rich-versioned-pe",
                "o": 32032,
                "z": 5
              },
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 31998,
                "z": 15
              },
              {
                "c": 2,
                "d": "PE FileVersion metadata field",
                "i": "metadata/package/versioning::pe-fileversion-field",
                "o": 32050,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 32106,
                "z": 12
              }
            ],
            "x": true
          },
          {
            "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-c\u0026=Qmdf7E\u003cg5%0df-T3g00000jobY*0rt)}ASx!Nx8(SCzua8ByYD{8x-I@HwDlPFve$cAwDhYgy5\u0026qPwb{SIB]Tb{A@ZE=A@Vgug5}QX0rt{@ASy1Twb{-Lv/QPJp5[Y5z2!bE00000n=S]jl\u0026.lcx-JqRwDl-J00000job=\u00260rt{@ASy1Twb{-Lv/QPJrSDXhASydXx-J5Kzu6Upf-S:8gYPohec4y8ec4B9",
            "l": 32172,
            "n": [
              {
                "c": 2,
                "d": "Copyright notice",
                "i": "metadata/package/license::copyright-word",
                "o": 32188,
                "z": 9
              },
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 32234,
                "z": 16
              },
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 32294,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE ProductVersion metadata field",
                "i": "metadata/package/versioning::pe-productversion-field",
                "o": 32346,
                "z": 14
              },
              {
                "c": 1,
                "d": "PE ProductName field is populated",
                "i": "metadata/package/versioning::pe-product-name-present",
                "o": 32320,
                "z": 8
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000001Ybg3\u0026*nc88S)d03zmwR#M!$SXz)Q9wF6.fG9#gJY9aWQbz",
            "l": 32752,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 32768,
                "z": 6
              }
            ],
            "x": true
          },
          {
            "b": "P/n]eWL]i^brdbif/Sk]wh[-(D]M%xPG5@hZ=oE@}8FyljVM[gwi1r-y=MC{Bub^IQb*BT!hXd5yDw1E5iy)]i6fO\u003esuzE61W0CXj3n0PG/\u003eFWP/*W:13Fg#QckFsUSS^^aWg0iYGTm$+%6Yx2r%j[b%J$ChA$\u003etY*6L405axM5ch+h5hk4ScONtgrXQQe0wK\u003cm4(55UDOISSWLtGJ:1=g295n(%gCRfIpCM6dM[\u003eD)URJ*C?7*#Dx!%V-BtFk0E\u003e#^mIzHs",
            "l": 32816,
            "n": [
              {
                "c": 3,
                "d": "Open Windows Filtering Platform engine",
                "i": "micro-behaviors/os/firewall/wfp::fwpm-engine-open",
                "o": 32836,
                "z": 15
              },
              {
                "c": 3,
                "d": "Install Windows Filtering Platform filter",
                "i": "micro-behaviors/os/firewall/wfp::fwpm-filter-add",
                "o": 32860,
                "z": 14
              },
              {
                "c": 2,
                "d": "Kernel pool memory allocation",
                "i": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc",
                "o": 32944,
                "z": 21
              },
              {
                "c": 2,
                "d": "Memory copy operation",
                "i": "micro-behaviors/mem/c-runtime/functions::memcpy",
                "o": 32916,
                "z": 6
              },
              {
                "c": 2,
                "d": "Memory move with overlap",
                "i": "micro-behaviors/mem/c-runtime/functions::memmove",
                "o": 32988,
                "z": 7
              }
            ],
            "x": true
          },
          {
            "b": "wnMm5whbbV90MHB1pt!So\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zzrN]cK6VM1oPqWo\u003e!9Tz/Y\u0026eBrA}?wmV(:wPzG%x-",
            "l": 37148,
            "n": [
              {
                "c": 2,
                "d": "Embedded Microsoft vendor marker",
                "i": "metadata/binary/vendor::microsoft-corp-marker",
                "o": 37164,
                "z": 21
              }
            ],
            "x": true
          }
        ],
        "idn": {
          "name": {
            "value": "jsdrv.sys",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "ca_signed",
          "signer": {
            "issuer": "CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB",
            "source": "pe.signatures[0]",
            "subject": "CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,POSTALCODE=31905,C=IL",
            "common_name": "Shopper-Pro (GOOBZO LTD)",
            "organization": "Shopper-Pro (GOOBZO LTD)"
          },
          "project": {
            "value": "JsDriver",
            "source": "pe.version.product_name",
            "verified": false
          },
          "version": {
            "value": "1,42,1,2463",
            "source": "pe.version.file_version",
            "verified": false
          },
          "build_path": {
            "value": "C:\\Builds\\Build_ShopperProMulti\\JSDriver\\1.42.0.0\\VA_3_2\\Bin\\Release\\jsdrv.pdb",
            "source": "pe.debug.pdb.path",
            "verified": false
          },
          "unique_ids": {
            "authenticode_thumbprint_sha256": "4bcfa416af77b39a7ad3122d23ebddb231da49556356e3368cb36faa6c19824e"
          },
          "organization": {
            "value": "Shopper-Pro (GOOBZO LTD)",
            "source": "pe.signatures[0]",
            "verified": true
          }
        },
        "mol": "O(Er)H₂(MgOs)Md₂(Bi₂Si₂)",
        "sha": "5fcc5f5c42f6c4702b86d10496e6b1b30322eb04922c45c0c37222c4f7102995",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "ntoskrnl.exe",
              "RtlUnwind"
            ],
            [
              "ntoskrnl.exe",
              "memset"
            ],
            [
              "ntoskrnl.exe",
              "memcpy"
            ],
            [
              "ntoskrnl.exe",
              "MmIsAddressValid"
            ],
            [
              "ntoskrnl.exe",
              "ExUuidCreate"
            ],
            [
              "ntoskrnl.exe",
              "IoFreeMdl"
            ],
            [
              "ntoskrnl.exe",
              "IoAllocateMdl"
            ],
            [
              "ntoskrnl.exe",
              "MmBuildMdlForNonPagedPool"
            ],
            [
              "ntoskrnl.exe",
              "ExFreePoolWithTag"
            ],
            [
              "ntoskrnl.exe",
              "ExAllocatePoolWithTag"
            ],
            [
              "ntoskrnl.exe",
              "KeWaitForSingleObject"
            ],
            [
              "ntoskrnl.exe",
              "KeDelayExecutionThread"
            ],
            [
              "ntoskrnl.exe",
              "KeReleaseSemaphore"
            ],
            [
              "ntoskrnl.exe",
              "KeInitializeSemaphore"
            ],
            [
              "ntoskrnl.exe",
              "KeTickCount"
            ],
            [
              "ntoskrnl.exe",
              "KeBugCheckEx"
            ],
            [
              "ntoskrnl.exe",
              "RtlCopyUnicodeString"
            ],
            [
              "ntoskrnl.exe",
              "wcsstr"
            ],
            [
              "ntoskrnl.exe",
              "wcsrchr"
            ],
            [
              "ntoskrnl.exe",
              "wcsncpy"
            ],
            [
              "ntoskrnl.exe",
              "memmove"
            ],
            [
              "ndis",
              "NdisAllocateGenericObject"
            ],
            [
              "ndis",
              "NdisFreeNetBufferListPool"
            ],
            [
              "ndis",
              "NdisAllocateNetBufferListPool"
            ],
            [
              "ndis",
              "NdisFreeGenericObject"
            ],
            [
              "fwpkclnt",
              "FwpmTransactionAbort0"
            ],
            [
              "fwpkclnt",
              "FwpmTransactionCommit0"
            ],
            [
              "fwpkclnt",
              "FwpmTransactionBegin0"
            ],
            [
              "fwpkclnt",
              "FwpmEngineClose0"
            ],
            [
              "fwpkclnt",
              "FwpmEngineOpen0"
            ],
            [
              "fwpkclnt",
              "FwpsCopyStreamDataToBuffer0"
            ],
            [
              "fwpkclnt",
              "FwpsStreamInjectAsync0"
            ],
            [
              "fwpkclnt",
              "FwpmCalloutAdd0"
            ],
            [
              "fwpkclnt",
              "FwpmCalloutDeleteByKey0"
            ],
            [
              "fwpkclnt",
              "FwpmFilterDeleteById0"
            ],
            [
              "fwpkclnt",
              "FwpmFilterAdd0"
            ],
            [
              "fwpkclnt",
              "FwpsCalloutRegister0"
            ],
            [
              "fwpkclnt",
              "FwpsCalloutUnregisterByKey0"
            ],
            [
              "fwpkclnt",
              "FwpsFlowAssociateContext0"
            ],
            [
              "fwpkclnt",
              "FwpsFlowRemoveContext0"
            ],
            [
              "fwpkclnt",
              "FwpsInjectionHandleCreate0"
            ],
            [
              "fwpkclnt",
              "FwpsInjectionHandleDestroy0"
            ],
            [
              "fwpkclnt",
              "FwpsAllocateNetBufferAndNetBufferList0"
            ],
            [
              "fwpkclnt",
              "FwpsFreeNetBufferList0"
            ],
            [
              "fwpkclnt",
              "FwpsInjectTransportReceiveAsync0"
            ],
            [
              "fwpkclnt",
              "FwpsQueryPacketInjectionState0"
            ],
            [
              "hal",
              "KeReleaseInStackQueuedSpinLock"
            ],
            [
              "hal",
              "KeAcquireInStackQueuedSpinLock"
            ],
            [
              "wdfldr",
              "WdfVersionBindClass"
            ],
            [
              "wdfldr",
              "WdfVersionUnbindClass"
            ],
            [
              "wdfldr",
              "WdfVersionBind"
            ],
            [
              "wdfldr",
              "WdfVersionUnbind"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 42324.0,
              "has_safe_seh": 1.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "cert_table_size": 6816.0,
              "has_version_info": 1.0,
              "computed_checksum": 42324.0,
              "reloc_overhang_bytes": 628.0,
              "reloc_overhang_ratio": 0.41,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 10.0,
              "base_relocation_entry_count": 414.0
            },
            "file": {
              "size": 41120.0,
              "entropy": 6.22,
              "size_bytes": 41120.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.66,
              "data_entropy": 0.65,
              "overlay_size": 6816.0,
              "string_count": 139.0,
              "overlay_ratio": 0.17,
              "overall_entropy": 6.22,
              "overlay_entropy": 7.44,
              "entropy_variance": 2.99,
              "avg_string_length": 19.92,
              "max_string_length": 174.0,
              "code_to_data_ratio": 0.98,
              "string_length_stddev": 18.85,
              "largest_section_ratio": 0.64,
              "sentence_string_count": 14.0,
              "sentence_string_ratio": 0.1,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 52.0
            },
            "sections": {
              "count": 6.0,
              "code_size": 28160.0,
              "entropy_max": 5.7,
              "entropy_mean": 3.72,
              "name_entropy": 3.55,
              "writable_count": 2.0,
              "executable_count": 2.0,
              "nonstandard_count": 1.0,
              "executable_writable_count": 1.0
            },
            "dependencies": {
              "count": 5.0
            }
          },
          "sec": [
            [
              ".text",
              1024,
              26112,
              5.7,
              "r-x"
            ],
            [
              ".rdata",
              27136,
              2048,
              3.62,
              "r--"
            ],
            [
              ".data",
              29184,
              512,
              0.65,
              "rw-"
            ],
            [
              "INIT",
              29696,
              2048,
              5.23,
              "rwx"
            ],
            [
              ".rsrc",
              31744,
              1024,
              2.49,
              "r--"
            ],
            [
              ".reloc",
              32768,
              1536,
              4.63,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              504,
              "u8",
              ".text"
            ],
            [
              543,
              "u8",
              "h.rdata"
            ],
            [
              583,
              "u8",
              "H.data"
            ],
            [
              624,
              "u8",
              "INIT"
            ],
            [
              664,
              "u8",
              ".rsrc"
            ],
            [
              703,
              "u8",
              "B.reloc"
            ],
            [
              5317,
              "u8",
              "Qh-sbi"
            ],
            [
              11912,
              "u8",
              "POSTtN"
            ],
            [
              12411,
              "u8",
              "hSbno"
            ],
            [
              12512,
              "u8",
              "Sbnp"
            ],
            [
              18805,
              "u8",
              "Qh-stl"
            ],
            [
              25631,
              "u8",
              "URPQQh"
            ],
            [
              25858,
              "u8",
              "UVWS"
            ],
            [
              25989,
              "u8",
              "UQPXY]Y["
            ],
            [
              28672,
              "u8",
              "RSDSn"
            ],
            [
              28696,
              "u8",
              "C:\\Builds\\Build_ShopperProMulti\\JSDriver\\1.42.0.0\\VA_3_2\\Bin\\Release\\jsdrv.pdb"
            ],
            [
              29707,
              "u8",
              "QQVW3"
            ],
            [
              29867,
              "u8",
              "cAMDt"
            ],
            [
              29876,
              "u8",
              "aulsu"
            ],
            [
              30278,
              "u8",
              "memmove"
            ],
            [
              30288,
              "u8",
              "wcsncpy"
            ],
            [
              30298,
              "u8",
              "wcsrchr"
            ],
            [
              30318,
              "u8",
              "KeInitializeSemaphore"
            ],
            [
              30342,
              "u8",
              "KeReleaseSemaphore"
            ],
            [
              30364,
              "u8",
              "KeDelayExecutionThread"
            ],
            [
              30390,
              "u8",
              "KeWaitForSingleObject"
            ],
            [
              30414,
              "u8",
              "ExAllocatePoolWithTag"
            ],
            [
              30438,
              "u8",
              "ExFreePoolWithTag"
            ],
            [
              30458,
              "u8",
              "MmBuildMdlForNonPagedPool"
            ],
            [
              30486,
              "u8",
              "IoAllocateMdl"
            ],
            [
              30502,
              "u8",
              "IoFreeMdl"
            ],
            [
              30514,
              "u8",
              "ExUuidCreate"
            ],
            [
              30530,
              "u8",
              "MmIsAddressValid"
            ],
            [
              30550,
              "u8",
              "memcpy"
            ],
            [
              30560,
              "u8",
              "memset"
            ],
            [
              30568,
              "u8",
              "ntoskrnl.exe"
            ],
            [
              30584,
              "u8",
              "RtlUnwind"
            ],
            [
              30596,
              "u8",
              "NdisAllocateGenericObject"
            ],
            [
              30624,
              "u8",
              "NdisFreeGenericObject"
            ],
            [
              30648,
              "u8",
              "NdisAllocateNetBufferListPool"
            ],
            [
              30680,
              "u8",
              "NdisFreeNetBufferListPool"
            ],
            [
              30706,
              "u8",
              "NDIS.SYS"
            ],
            [
              30718,
              "u8",
              "FwpsCalloutRegister0"
            ],
            [
              30742,
              "u8",
              "FwpsCalloutUnregisterByKey0"
            ],
            [
              30772,
              "u8",
              "FwpsFlowAssociateContext0"
            ],
            [
              30800,
              "u8",
              "FwpsFlowRemoveContext0"
            ],
            [
              30826,
              "u8",
              "FwpsInjectionHandleCreate0"
            ],
            [
              30856,
              "u8",
              "FwpsInjectionHandleDestroy0"
            ],
            [
              30886,
              "u8",
              "FwpsAllocateNetBufferAndNetBufferList0"
            ],
            [
              30928,
              "u8",
              "FwpsFreeNetBufferList0"
            ],
            [
              30954,
              "u8",
              "FwpsInjectTransportReceiveAsync0"
            ],
            [
              30990,
              "u8",
              "FwpsQueryPacketInjectionState0"
            ],
            [
              31024,
              "u8",
              "FwpsStreamInjectAsync0"
            ],
            [
              31050,
              "u8",
              "FwpsCopyStreamDataToBuffer0"
            ],
            [
              31080,
              "u8",
              "FwpmEngineOpen0"
            ],
            [
              31098,
              "u8",
              "FwpmEngineClose0"
            ],
            [
              31118,
              "u8",
              "FwpmTransactionBegin0"
            ],
            [
              31142,
              "u8",
              "FwpmTransactionCommit0"
            ],
            [
              31168,
              "u8",
              "FwpmTransactionAbort0"
            ],
            [
              31192,
              "u8",
              "FwpmCalloutAdd0"
            ],
            [
              31210,
              "u8",
              "FwpmCalloutDeleteByKey0"
            ],
            [
              31236,
              "u8",
              "FwpmFilterAdd0"
            ],
            [
              31254,
              "u8",
              "FwpmFilterDeleteById0"
            ],
            [
              31276,
              "u8",
              "fwpkclnt.sys"
            ],
            [
              31292,
              "u8",
              "KeAcquireInStackQueuedSpinLock"
            ],
            [
              31326,
              "u8",
              "KeReleaseInStackQueuedSpinLock"
            ],
            [
              31358,
              "u8",
              "HAL.dll"
            ],
            [
              31368,
              "u8",
              "KeTickCount"
            ],
            [
              31382,
              "u8",
              "KeBugCheckEx"
            ],
            [
              31398,
              "u8",
              "RtlCopyUnicodeString"
            ],
            [
              31422,
              "u8",
              "WdfVersionUnbind"
            ],
            [
              31442,
              "u8",
              "WdfVersionBind"
            ],
            [
              31460,
              "u8",
              "WdfVersionBindClass"
            ],
            [
              31482,
              "u8",
              "WdfVersionUnbindClass"
            ],
            [
              31504,
              "u8",
              "WDFLDR.SYS"
            ],
            [
              34366,
              "u8",
              "Z0X03"
            ],
            [
              34547,
              "u8",
              "Salt Lake City1"
            ],
            [
              34572,
              "u8",
              "The USERTRUST Network1!0"
            ],
            [
              34604,
              "u8",
              "http://www.usertrust.com1"
            ],
            [
              34639,
              "u8",
              "UTN-USERFirst-Object0"
            ],
            [
              34663,
              "u8",
              "110824000000Z"
            ],
            [
              34717,
              "u8",
              "Greater Manchester1"
            ],
            [
              34746,
              "u8",
              "Salford1"
            ],
            [
              34764,
              "u8",
              "COMODO CA Limited1!0"
            ],
            [
              34792,
              "u8",
              "COMODO Code Signing CA 20"
            ],
            [
              35276,
              "u8",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t"
            ],
            [
              35355,
              "u8",
              "1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%"
            ],
            [
              35419,
              "u8",
              "http://ocsp.usertrust.com0"
            ],
            [
              35911,
              "u8",
              "151231235959Z0"
            ],
            [
              35951,
              "u8",
              "319051"
            ],
            [
              35967,
              "u8",
              "Haifa1"
            ],
            [
              35999,
              "u8",
              "Bldg #15 Matam1!0"
            ],
            [
              36024,
              "u8",
              "Shopper-Pro (GOOBZO LTD)1!0"
            ],
            [
              36059,
              "u8",
              "Shopper-Pro (GOOBZO LTD)0"
            ],
            [
              36562,
              "u8",
              "https://secure.comodo.net/CPS0A"
            ],
            [
              36609,
              "u8",
              "0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r"
            ],
            [
              36687,
              "u8",
              "0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$"
            ],
            [
              36750,
              "u8",
              "http://ocsp.comodoca.com0"
            ],
            [
              37125,
              "u8",
              "Washington1"
            ],
            [
              37146,
              "u8",
              "Redmond1"
            ],
            [
              37164,
              "u8",
              "Microsoft Corporation1)0'"
            ],
            [
              37195,
              "u8",
              "Microsoft Code Verification Root0"
            ],
            [
              37232,
              "u8",
              "130815202820Z"
            ],
            [
              37247,
              "u8",
              "230815203820Z0"
            ],
            [
              37838,
              "u8",
              "N0L0J"
            ],
            [
              37848,
              "u8",
              "Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0"
            ],
            [
              38425,
              "u8",
              "`7VE#4`"
            ],
            [
              38564,
              "u8",
              "COMODO Code Signing CA 2"
            ],
            [
              39170,
              "u8",
              "20150910051502Z"
            ],
            [
              39264,
              "u8",
              "COMODO CA Limited1$0\""
            ],
            [
              39292,
              "u8",
              "COMODO Time Stamping Signer"
            ],
            [
              39655,
              "u8",
              "COMODO Time Stamping Signer0"
            ],
            [
              40118,
              "u8",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05"
            ],
            [
              40645,
              "u8",
              "UTN-USERFirst-Object"
            ],
            [
              26974,
              "wide",
              "Callout"
            ],
            [
              26990,
              "wide",
              "filter"
            ],
            [
              27004,
              "wide",
              "\\Device\\jsdrv1,42,1,2463"
            ],
            [
              27054,
              "wide",
              "\\DosDevices\\Global\\jsdrv1,42,1,2463"
            ],
            [
              27432,
              "wide",
              "wget.exe iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe "
            ],
            [
              28198,
              "wide",
              "@D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGW;;;WD)(A;;GR;;;RC)"
            ],
            [
              28328,
              "wide",
              "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)"
            ],
            [
              28576,
              "wide",
              "KmdfLibrary"
            ],
            [
              31846,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              31938,
              "wide",
              "StringFileInfo"
            ],
            [
              31974,
              "wide",
              "040904b0"
            ],
            [
              31998,
              "wide",
              "FileDescription"
            ],
            [
              32050,
              "wide",
              "FileVersion"
            ],
            [
              32076,
              "wide",
              "1,42,1,2463"
            ],
            [
              32106,
              "wide",
              "InternalName"
            ],
            [
              32132,
              "wide",
              "jsdrv.sys"
            ],
            [
              32158,
              "wide",
              "LegalCopyright"
            ],
            [
              32188,
              "wide",
              "Copyright (C) 2014"
            ],
            [
              32234,
              "wide",
              "OriginalFilename"
            ],
            [
              32294,
              "wide",
              "ProductName"
            ],
            [
              32320,
              "wide",
              "JsDriver"
            ],
            [
              32346,
              "wide",
              "ProductVersion"
            ],
            [
              32406,
              "wide",
              "VarFileInfo"
            ],
            [
              32438,
              "wide",
              "Translation"
            ]
          ],
          "val": {
            "file.stem": "22894",
            "pe.imphash": "05f16c01c39205eeba256789c579f337",
            "pe.machine": "i386",
            "pe.rich.key": 613887539,
            "pe.rich.hash": "0cb628efc2febf4333f4bbfadb711fdd",
            "pe.subsystem": "native",
            "pe.timestamp": 1441861892,
            "file.basename": "22894",
            "pe.image_base": 4194304,
            "pe.image_size": 53248,
            "pe.machine_id": 332,
            "pe.os_version": "6.2",
            "pe.version.os": "windows_nt_windows32",
            "pe.entry_point": 29726,
            "pe.headers_size": 1024,
            "pe.version.type": "unknown",
            "pe.debug.pdb.age": 1,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 1,
            "pe.debug.pdb.guid": "99edab6e-18c0-45fd-a2bd-8926375b71ac",
            "pe.debug.pdb.path": "C:\\Builds\\Build_ShopperProMulti\\JSDriver\\1.42.0.0\\VA_3_2\\Bin\\Release\\jsdrv.pdb",
            "pe.debug.pdb.stem": "jsdrv",
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "ebe38c565f2afd92514fa1fe8f1283b1b9fb9314",
            "pe.load_config.size": 72,
            "pe.image_hash.sha256": "996034eeb8d2690680504f4ab7d704a1cf0aef194952a759f3e2a335bb0c795f",
            "pe.image_hash.sha384": "3a4fc5374ed9a5fb0a2d3290081ecbfa602b7afaa4fb882b09973dc14f726c8d79a3b2093eed67da28d5077f5d82f15f",
            "pe.image_hash.sha512": "8f5e7ee135eefcd24e26aeb4f34d017aae5a848797d9cdd0ab0023d30a65159391bac91caf961bcebbd884bd3ffa438d32ef4c7a1792974c0dcaa400b4d98214",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "6.1",
            "pe.version.copyright": "Copyright (C) 2014",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.debug.pdb.basename": "jsdrv.pdb",
            "pe.characteristics_raw": 258,
            "pe.debug.pdb.timestamp": 1441861892,
            "pe.version.description": "jsdrv",
            "pe.inflated_sections[0]": ".data",
            "pe.linker_major_version": 11,
            "pe.signatures[0].issuer": "CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB",
            "pe.signatures[0].serial": "00e616c6cd7010c197e7228f66f5b286bb",
            "pe.version.file_version": "1,42,1,2463",
            "pe.version.product_name": "JsDriver",
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "codeview",
            "pe.debug.entries[1].type": "vc_feature",
            "pe.debug.pdb.path_offset": 28696,
            "pe.signatures[0].subject": "CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,POSTALCODE=31905,C=IL",
            "pe.version.internal_name": "jsdrv.sys",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 41192,
            "pe.data_directories[1].rva": 45056,
            "pe.data_directories[2].rva": 34304,
            "pe.data_directories[3].rva": 49152,
            "pe.data_directories[4].rva": 33008,
            "pe.data_directories[5].rva": 34232,
            "pe.data_directories[6].rva": 32768,
            "pe.dll_characteristics_raw": 320,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2015-12-31T23:59:59Z",
            "pe.version.product_version": "1,42,1,2463",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 120,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 728,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 6816,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 908,
            "pe.data_directories[4].name": "debug",
            "pe.data_directories[4].size": 56,
            "pe.data_directories[5].name": "load_config",
            "pe.data_directories[5].size": 64,
            "pe.data_directories[6].name": "iat",
            "pe.data_directories[6].size": 228,
            "pe.debug.entries[0].type_id": 2,
            "pe.debug.entries[1].type_id": 12,
            "pe.rich.entries[0].build_id": 132,
            "pe.rich.entries[1].build_id": 187,
            "pe.rich.entries[2].build_id": 188,
            "pe.rich.entries[3].build_id": 131,
            "pe.rich.entries[4].build_id": 149,
            "pe.rich.entries[5].build_id": 147,
            "pe.rich.entries[6].build_id": 1,
            "pe.rich.entries[7].build_id": 207,
            "pe.rich.entries[8].build_id": 201,
            "pe.rich.entries[9].build_id": 204,
            "pe.signatures[0].not_before": "2015-02-11T00:00:00Z",
            "pe.version.copyright_offset": 32188,
            "pe.rich.entries[0].use_count": 3,
            "pe.rich.entries[1].use_count": 1,
            "pe.rich.entries[2].use_count": 5,
            "pe.rich.entries[3].use_count": 3,
            "pe.rich.entries[4].use_count": 2,
            "pe.rich.entries[5].use_count": 13,
            "pe.rich.entries[6].use_count": 62,
            "pe.rich.entries[7].use_count": 3,
            "pe.rich.entries[8].use_count": 1,
            "pe.rich.entries[9].use_count": 1,
            "pe.version.original_filename": "jsdrv.sys",
            "pe.coff.dos_header_pe_pointer": 256,
            "pe.rich.entries[0].product_id": 30729,
            "pe.rich.entries[1].product_id": 30716,
            "pe.rich.entries[2].product_id": 30716,
            "pe.rich.entries[3].product_id": 30729,
            "pe.rich.entries[4].product_id": 30729,
            "pe.rich.entries[5].product_id": 30729,
            "pe.rich.entries[7].product_id": 50727,
            "pe.rich.entries[8].product_id": 50727,
            "pe.rich.entries[9].product_id": 50727,
            "pe.version.description_offset": 32032,
            "pe.debug.entries[0].size_bytes": 103,
            "pe.debug.entries[1].size_bytes": 16,
            "pe.load_config.security_cookie": 4231196,
            "pe.version.file_version_offset": 32076,
            "pe.version.product_name_offset": 32320,
            "pe.base_relocations.block_count": 10,
            "pe.base_relocations.entry_count": 414,
            "pe.load_config.se_handler_count": 2,
            "pe.load_config.se_handler_table": 4228736,
            "pe.version.internal_name_offset": 32132,
            "pe.signatures[0].thumbprint_sha1": "758e8be165d8ed847b873d5d5a5caa2955ab6286",
            "pe.signatures[0].cert_chain_depth": 3,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "ebe38c565f2afd92514fa1fe8f1283b1b9fb9314",
            "pe.version.product_version_offset": 32376,
            "pe.debug.entries[0].timestamp_unix": 1441861892,
            "pe.debug.entries[1].timestamp_unix": 1441861892,
            "pe.signatures[0].thumbprint_sha256": "4bcfa416af77b39a7ad3122d23ebddb231da49556356e3368cb36faa6c19824e",
            "pe.version.original_filename_offset": 32268,
            "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1"
          }
        },
        "find": [
          {
            "id": "metadata/signed/unknown::shopper-pro-goobzo-ltd",
            "conf": 1.0,
            "crit": 3,
            "desc": "Authenticode chain CN: Shopper-Pro (GOOBZO LTD)"
          },
          {
            "id": "metadata/signed/leaf::shopper-pro-goobzo-ltd",
            "conf": 1.0,
            "crit": 3,
            "desc": "Signed by Shopper-Pro (GOOBZO LTD)"
          },
          {
            "id": "metadata/signed/certificate::pe-signature-verified-kv",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE Authenticode signature verified metadata"
          },
          {
            "id": "micro-behaviors/mem/alloc/executable::nonpaged-pool",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "NonPagedPool kernel memory flag"
          },
          {
            "id": "metadata/binary/debug::pdb-absolute-path",
            "conf": 0.7200000286102295,
            "crit": 3,
            "desc": "Embedded absolute PDB path"
          },
          {
            "id": "metadata/binary/metrics/threshold::many-imports-50",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 50+ imports"
          },
          {
            "id": "micro-behaviors/os/firewall/wfp::fwpm-filter-add",
            "atk": "T1562.004",
            "conf": 0.9300000071525574,
            "crit": 3,
            "desc": "Install Windows Filtering Platform filter"
          },
          {
            "id": "micro-behaviors/os/firewall/wfp::fwpm-filter-delete-by-id",
            "atk": "T1562.004",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "Remove Windows Filtering Platform filter"
          },
          {
            "id": "objectives/collection/stealer/browser::browser-process-opera",
            "conf": 0.8199999928474426,
            "crit": 1,
            "desc": "Opera browser process name"
          },
          {
            "id": "metadata/binary/vendor::microsoft-corp-marker-cert",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Microsoft vendor marker in certificate data"
          },
          {
            "id": "metadata/signed/certificate::pe-cert-issuer-comodo",
            "conf": 1.0,
            "crit": 2,
            "desc": "Issued by Comodo Code Signing CA"
          },
          {
            "id": "metadata/package/versioning::pe-product-name-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE ProductName field is populated"
          },
          {
            "id": "micro-behaviors/os/firewall/wfp::fwpm-engine-open",
            "atk": "T1562.004",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Open Windows Filtering Platform engine"
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field"
          },
          {
            "id": "metadata/package/versioning::pe-file-description-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE FileDescription field is populated"
          },
          {
            "id": "micro-behaviors/process/enumerate/apps::browser-apps-firefox-exe",
            "atk": "T1057",
            "mbc": "E1592",
            "crit": 2,
            "desc": "Firefox Windows executable"
          },
          {
            "id": "metadata/binary/debug::pdb-visual-studio",
            "crit": 3,
            "desc": "Visual Studio build path"
          },
          {
            "id": "metadata/binary/layout::has-overlay",
            "conf": 1.0,
            "crit": 3,
            "desc": "PE binary has trailing overlay data"
          },
          {
            "id": "objectives/collection/stealer/browser::browser-process-chrome",
            "conf": 0.8199999928474426,
            "crit": 1,
            "desc": "Chrome browser process name"
          },
          {
            "id": "metadata/package/versioning::pe-legal-copyright-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE LegalCopyright field is populated"
          },
          {
            "id": "micro-behaviors/process/enumerate/apps::browser-apps-chrome-firefox",
            "atk": "T1057",
            "mbc": "E1592",
            "crit": 2,
            "desc": "Browser app chrome"
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure"
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field"
          },
          {
            "id": "micro-behaviors/process/enumerate/apps::browser-apps-opera-brave",
            "atk": "T1057",
            "mbc": "E1592",
            "crit": 2,
            "desc": "Browser app opera"
          },
          {
            "id": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem",
            "atk": "T1036.005",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "PE stem disagrees with embedded PDB stem"
          },
          {
            "id": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore",
            "atk": "T1057",
            "mbc": "E1592",
            "crit": 3,
            "desc": "Browser app iexplore"
          },
          {
            "id": "metadata/signed/trust-level::signer-evidence-present",
            "conf": 1.0,
            "crit": 1,
            "desc": "Platform or developer signing evidence"
          },
          {
            "id": "metadata/binary/vendor::microsoft-corp-marker",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Embedded Microsoft vendor marker"
          },
          {
            "id": "micro-behaviors/process/enumerate/apps::browser-apps",
            "atk": "T1057",
            "mbc": "E1592",
            "crit": 3,
            "desc": "Browser application name markers"
          }
        ],
        "path": "22894",
        "risk": 8,
        "size": 41120,
        "type": "pe"
      }
    ]
  }
}